CVE-2021-32760

Katalog CVE

CVSS 6.3 · Medium EPSS 1,6%

Kerentanan Exposure of Resource to Wrong Sphere pada linuxfoundation containerd, fedoraproject fedora. Skor CVSS 3.1 6.3 (Medium) menurut NVD.

Deskripsi (NVD)

containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files.

Rincian

Terbit di NVD

19 Juli 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-668: Exposure of Resource to Wrong Sphere
CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/containerd/containerd/releases/tag/v1.4.8 release notes · advisory pihak ketiga
• https://github.com/containerd/containerd/releases/tag/v1.5.4 release notes · advisory pihak ketiga
• https://github.com/containerd/containerd/security/advisories/GHSA-c72p-9xmj-rx3w advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDMNDPJJTP3J5...
• https://security.gentoo.org/glsa/202401-31